AWS Backup Terraform: Centralized Data Protection as Code

AWS Backup is a fully managed backup service that makes it easy to centralize and automate data protection across AWS services. Setting up AWS Backup with Terraform provides a comprehensive guide to configuring AWS Backup for centralized data protection using Terraform Infrastructure as Code. The combination gives teams repeatable, version-controlled backup infrastructure that can be deployed across multiple accounts and regions without clicking through the console.

Backing up AWS resources isn't optional. AWS Backup gives a centralized way to automate and manage backups across services like EC2, RDS, EFS, DynamoDB, and more. When you combine it with Terraform, you get repeatable, version-controlled backup infrastructure that you can deploy across multiple accounts and regions without clicking through the console.

In this post, we'll walk through setting up a complete AWS Backup plan with Terraform, covering vaults, plans, rules, selections, and lifecycle policies.

Why Terraform for AWS Backup

Manual backup configuration through the console is fine for a single account with a handful of resources. But once you're managing multiple environments or accounts, things get messy fast. Terraform lets you define backup policies as code that lives in your repo, apply consistent backup schedules across all environments, track changes to backup configurations through version control, roll back backup policy changes if something goes wrong, and replicate backup strategies across AWS accounts.

You define the AWS Backup plan, vault, and selection inside Terraform modules. Apply them with the same workflow you use for EC2 or S3 resources. Terraform translates these declarations into AWS Backup configurations that automatically enforce recovery points and tag compliance. This ensures backups match the desired state instead of yesterday's guesswork.

A clean AWS Backup Terraform setup starts with identity. Use AWS IAM roles with least privilege access, map them to your Terraform state backend, and make backup policies resources that are as code-driven as your networks or compute stacks. The magic lies in describing retention rules, schedules, and vaults as Terraform resources rather than manual AWS Console inputs. Every update becomes part of your audit trail. Every restore request follows predefined logic instead of improvisation.

How do I integrate AWS Backup with Terraform? You define the AWS Backup plan, vault, and selection inside Terraform modules. Apply them with the same workflow you use for EC2 or S3 resources.

Core AWS Backup Concepts in Terraform

AWS Backup is a fully managed backup service that makes it easy to centralize and automate the back up of data across AWS services such as Amazon EBS volumes, Amazon EC2 instances, Amazon RDS databases, Amazon DynamoDB tables, Amazon EFS file systems, and AWS Storage Gateway volumes.

A backup vault is where your recovery points are stored. The vault is the storage container for backups and is the first Terraform resource to define.

A backup plan defines the schedule and retention for backups. Plans contain rules that specify when backups run and where they are stored.

A backup selection defines which resources are included in a plan. Selection typically uses tags or resource ARNs to scope coverage.

A lifecycle policy controls retention and transition of recovery points.

The Terraform module to provision AWS Backup is a fully managed backup service that makes it easy to centralize and automate the back up of data across AWS services.

Note on syntax changes. The syntax of declaring a backup schedule has changed as of release 0.14.0, follow the instructions in the 0.13.x to 0.14.x+ migration guide.

Warning on deprecation. The deprecated variables have been fully deprecated as of 1.x.x.

Prerequisites and Project Structure

Prerequisites for a basic setup include:

  • AWS CLI configured
  • Terraform installed
  • Understanding of backup requirements
  • Basic knowledge of AWS services

Project Structure for a typical repository is:

aws-backup-terraform/ ├── main.tf ├── variables.tf ├── outputs.tf └── terraform.tfvars

This structure separates provider configuration, resources, inputs, and outputs for reuse.

For centralized backup across AWS Organizations, additional prerequisites apply:

  • AWS Organizations enabled and access to the Management account
  • AWS Backup features enabled for your organization
  • An AWS account that will be used as your Central Backup account. This account should be registered as a delegated administrator for AWS Organizations
  • Terraform v1.3.6 or later installed

To manage the Terraform state, Amazon S3 is used to store our .tfstate file and a Amazon DynamoDB table to maintain the lock state of our environment. Create these resources and update the backend.tf file with the appropriate values. You can learn more about protecting sensitive data in the Terraform state file using the AWS Prescriptive Guidance.

If you plan to use the OrganizationAccountAccessRole for cross-account operations, then you do not need to create any additional roles for managing these resources. However, you will need to update the trust relationships with the Principal of the IAM role or user you will be using to run the Terraform commands from the Management account.

As a best practice, you will want to create roles specifically for Terraform to assume in each account following least privilege.

Basic AWS Backup Configuration

The basic AWS Backup Configuration starts with the provider.

hcl provider "aws" { region = var.aws_region }

AWS Backup Vault resource:

hcl resource "aws_backup_vault" "main" { name = "${var.project_name}-vault" kms_key_arn = aws_kms_key.backup.arn tags = { Environment = var.environment } }

KMS Key for Encryption:

hcl resource "aws_kms_key" "backup" { description = "KMS key for AWS Backup encryption" deletion_window_in_days = 7 enable_key_rotation = true tags = { Environment = var.environment } }

IAM Role for AWS Backup:

hcl resource "aws_iam_role" "backup" { name = "${var.project_name}-backup-role" assume_role_policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = "sts:AssumeRole" Effect = "Allow" Principal = { Service = "backup.amazonaws.com" } } ] }) }

IAM Policy attachment:

hcl resource "aws_iam_role_policy_attachment" "backup" { policy_arn = "arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup" role = aws_iam_role.backup.name }

Backup Plan:

hcl resource "aws_backup_plan" "main" { name = "${var.project_name}-backup-plan" rule { rule_name = "daily-backup" target_vault_name = aws_backup_vault.main.name schedule = "cron(0 5"

The schedule uses a cron expression. The rule references the vault created earlier.

Centralized Backup with AWS Organizations

This solution demonstrates how you can save time using Terraform to automate the deployment of your AWS Backup resources across accounts in your organization. Using this solution, you can centrally manage the deployment of AWS Backup resources, such as vaults, as well as backup policies, for all of your AWS Organizations accounts.

Centralized management ensures consistent vault naming, encryption, and retention across accounts. Terraform is used to automate deployment of AWS Backup resources across accounts in your organization.

Key components for centralized setup:

  • Central Backup account registered as delegated administrator for AWS Organizations
  • Terraform state stored in Amazon S3 with DynamoDB locking
  • IAM roles for Terraform to assume in each member account following least privilege
  • Backup vaults and plans deployed to each account via Terraform

This approach avoids manual console configuration per account and provides auditability through version control.

Operational Considerations

You open the cloud dashboard on Monday morning and realize half your test environments have vanished overnight. Someone's backup policy expired, and Terraform drifted out of sync. Nothing too catastrophic, but now every recovery step feels like rolling dice in traffic. This is exactly the moment when AWS Backup and Terraform should be saving you, not haunting your ticket queue.

AWS Backup provides centralized, policy-driven backups for EC2, RDS, DynamoDB, EFS, and more. Terraform, on the other hand, treats infrastructure as reproducible code. Combined, they give you full control of both backup creation and lifecycle automation, managed through versioned configuration instead of frantic clicks. But most teams wire them together lazily, which leaves giant cracks in permission boundaries and compliance logs.

A clean setup requires:

  • Identity defined with AWS IAM roles with least privilege access
  • Terraform state backend mapped and protected
  • Backup policies as code-driven resources
  • Retention rules, schedules, and vaults described as Terraform resources
  • Updates part of the audit trail
  • Restore requests following predefined logic instead of improvisation

Common Terraform Resources Table

Resource Purpose
awsbackupvault Storage container for recovery points
awskmskey Encryption key for vault
awsiamrole Role assumed by AWS Backup service
awsiamrolepolicyattachment Attach AWS managed service role policy
awsbackupplan Defines backup schedule and retention

Project Files Table

File Contains
main.tf Provider and core AWS Backup resources
variables.tf Input variables for project name, environment, region
outputs.tf Outputs for vault name, plan ARN
terraform.tfvars Values for variables

Conclusion

Conclusion

AWS Backup with Terraform moves backup configuration from manual console clicks to repeatable, auditable infrastructure as code. AWS Backup provides centralized automation for EC2, RDS, DynamoDB, EFS, and other services, while Terraform ensures those policies are version-controlled, consistent across environments, and recoverable through code history.

Setting up a backup vault as the storage foundation, securing it with KMS encryption, creating a least-privilege IAM role for AWS Backup, and defining a backup plan with a cron schedule forms the core pattern. Project structure with main.tf, variables.tf, outputs.tf, and terraform.tfvars keeps the configuration maintainable.

For organizations, Terraform automates deployment of vaults and backup policies across AWS Organizations accounts from a central backup account. Prerequisites include AWS Organizations enabled, AWS Backup features enabled, a central backup account registered as delegated administrator, and Terraform v1.3.6 or later installed. State management uses Amazon S3 for .tfstate storage and Amazon DynamoDB for locking.

Syntax changes matter. The syntax of declaring a backup schedule has changed as of release 0.14.0, and deprecated variables have been fully deprecated as of 1.x.x. Following migration guidance avoids drift.

When configured cleanly with identity first, least privilege roles, and code-driven retention rules, schedules, and vaults, AWS Backup and Terraform provide full control of backup creation and lifecycle automation with every update in the audit trail and every restore request following predefined logic.

Sources

  1. The Cloud Panda
  2. Terraform Foundation
  3. One Uptime
  4. Hoop
  5. AWS Samples

Related Posts